CVE-2026-77508
Low
Description
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.
SeverityLow
CVSS3.5
Exploit probability—
Product
Weblate
PublishedAug 26, 2026
First seenAug 26, 2026
Weakness typeCWE-302CWE-302CWE-841CWE-841
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WeblateOrg weblate | < 2026.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.